> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-keys.md).

# Credential keys

Understand the DESFire keys that Command Centre uses to encode and protect cards.

Command Centre's DESFire encoding uses three keys. This page explains what each key does, which system writes it, and which of them is safe to share.

DESFire uses a file system model. Applications, which behave like folders, are created on the card. Each application is secured by its own encryption layer and holds files with configurable access properties. A file can be fully encrypted, read only, or unencrypted.

### The three keys

| Key                               | NXP terminology         | Role                                                                                                                                                                                                                       |
| --------------------------------- | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Card Master Key (CMK)**         | PICC Master Key         | Locks the entire card. Written by the first system to encode the card. Can erase the card and change how the card behaves.                                                                                                 |
| **Default Application Key (DAK)** | Application Default Key | Authenticates the right to create new applications on the card. Written by the first encoder. Safe to share with third parties, because knowing it only allows creation of new applications, not reading of existing ones. |
| **Site Specific Key (SSK)**       | -                       | Encrypts the Gallagher Access object. Required to read credentials encoded by a given site.                                                                                                                                |

### How Command Centre encodes a card

1. The card is locked with the Card Master Key. This key is unique per card and is stored encrypted in the Command Centre database.
2. The site's Default Application Key is applied to the card.
3. The Default Application Key is used to create the Gallagher object, which is an application on the card.
4. The Gallagher object is encrypted with the Site Specific Key, or with the Gallagher Default keys if no SSK is configured.

### Why the Default Application Key exists

The Default Application Key lets other Gallagher sites, and third parties, add their own applications to the same card. That is what makes one card usable on multiple sites.

Command Centre does not prevent third parties from writing additional application folders to a card it has encoded, provided they have the Default Application Key.

> **Does sharing the Default Application Key reduce the security of the card?** Not in any meaningful way. The only thing someone can do with the Default Application Key is create a new application on the card. It does not allow reading or deleting of existing applications.

### Key locations in Configuration Client

You need sufficient rights in Configuration Client to view these.

* **Default Application Key:** Server Properties > Card Security > MIFARE Site Keys.
* **SSK / key seed:** Server Properties > Card Security. The value is masked with X characters unless you export it.

***

🔗 **Related**

* [Credentials - Site Specific Key (SSK) vs Default Site Key](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-site-specific-key-ssk-vs-d.md). How to tell which key your site is using, and what to do when cards single beep.
* [Credentials - Sharing DESFire cards between Sites](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-sharing-desfire-cards-betw.md). Using the Default Application Key to share a card between two sites.
* [Credentials - Non Diversified DESFire object](/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-non-diversified-desfire-ob.md). Adding a separately keyed object so a third party system can read the card.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-hardware/credentials/credential-information/credentials-keys.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.